Quantum secret sharing with continuous-variable cluster states 
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We extend the idea of cluster state quantum secret sharing to the continuous-variable regime. 
Both classical and quantum information can be shared by distributing finitely squeezed continuous- 
variable cluster states through either secure or insecure channels. We show that the sharing rate 
of classical secrets can be estimated by standard continuous-variable quantum key distribution 
techniques. We also analyse the performance of quantum state sharing by computing the shared 
entanglement between the authorised parties and the dealer. 



I. INTRODUCTION 

Secret sharing is a cryptographic task aiming to dis- 
tribute a secret amongst a group of parties. A good se- 
cret sharing protocols should allow authorised subsets of 
parties, known as the access structure, to faithfully re- 
construct the secret, while other unauthorized parties, 
known as the adversary structure, are denied any infor- 
mation about the secret. Classical secret sharing proto- 
cols have been proposed [H,[2| where classical information 
is encoded by a mathematical transformation. The proto- 
cols can be proven to be information-theoretically secure, 
i.e., no information about the secret can be obtained by 
the adversary structure even when they have unlimited 
computational power, if the communication channels be- 
tween the dealer and the parties are secure. 

Following the rapid development of quantum infor- 
mation, the extension of secret sharing to the quan- 
tum regime has received much theoretical attention [3H6| . 
The objective of quantum secret sharing (QSS) is to use 
the quantum correlations in well-constructed entangled 
states to securely transmit a set of classical or quantum 
information to only the access structures. As the involv- 
ing parties are supposed to be spatially well separated, 
an optical system is the most suitable implementation 
for QSS due to its excellent mobility. Several proof-of- 
principle experiments have already been demonstrated 
pH9|. However, constructing a large-scale optical QSS 
state is technically challenging, because the nonlinear in- 
teraction between photons is weak, and some QSS pro- 
tocols require more than two quantum levels, where the 
commonly employed polarisation encoding is not applica- 
ble. Recently, Markham and Sanders [10J proposed a uni- 
fied QSS approach based on qubit cluster states [lllfl3|. 
which could be constructed efficiently using only linear 
optics and post-selection [13l4l5j . 

Cluster states have another advantage in that an TV- 
mode cluster is well characterised by N stabilisers or an 
N- vertex connected graph, in contrast to a general quan- 
tum state that have to be expressed in an exponential 
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number of superpositions. Therefore, the theoretical con- 
struction and the security analysis of a cluster state QSS 
scheme could be simplified. The idea of cluster state 
QSS has also been extended to odd-dimensional states 
(qudits) in pj]. 

In this paper, we further extend the idea of cluster 
state QSS into the continuous-variable (CV) regime. CV 
cluster states are proposed to be useful resources to con- 
duct measurement-based universal quantum computa- 
tion [13, Ell]- As a CV cluster state is a Gaussian state, 
linear optics is sufficient for its construction [18|, fl9| . 
CV cluster states involving four o ptic al modes have been 
demonstrated experimentally [20, [21j . 

The main objective of this work is to investigate how 
quantum and classical secrets can be shared by CV clus- 
ter states. Instead of directly extending the qudit ap- 
proach to the d — > oo limit, a CV cluster state is critically 
different from its discrete- variable counterparts in that a 
perfect (infinitely squeezed) CV cluster state is physi- 
cally and hence, practically, impossible. We find that 
when realistic finitely squeezed cluster states are instead 
utilised, the security of the QSS is inevitably reduced, 
i.e., the secret is not precisely recovered by the access 
structure while partial information is leaked to unautho- 
rised parties. We suggest benchmarks to evaluate the 
performance of each of the QSS tasks. For the sharing 
of classical information, we calculate the amount of se- 
cure key that can be distilled from each cluster state for 
encoding the secret. For the sharing of quantum informa- 
tion, we estimate the number of cluster states required to 
establish a high fidelity teleportation channel to transmit 
the secret state. For simplicity, all quantum channels are 
assumed to be ideal, i.e., they are noiseless and lossless so 
that the state prepared by the dealer is the same as that 
received by the parties. The detectors are also assumed 
to be ideal. 

Our paper is outlined as follows. In Sec. [ill we intro- 
duce QSS and classify it into three tasks. The physical 
and mathematical background of CV cluster states are 
also reviewed. In Sec. IIIII and IIV1 we analyse the se- 
curity of classical information sharing when the cluster 
state is delivered through secure and insecure channels 
respectively. In Sec. [VI we discuss the performance of 
quantum state sharing. We conclude in Sec [VT] with a 
short discussion. We pick ft = 1 in the following calcula- 



tions, and all logarithms are to base 2. 



II. BACKGROUND 
A. Quantum secret sharing 

In literatures, the idea of QSS is developed to serve 
one of the following three tasks [10(] : 

CC: Classical information is shared among parties by 
distributing QSS states through (secure) private chan- 
nels, which are invulnerable to eavesdropping. The role 
of quantum resources is to substitute the classical secret 
sharing encoding by the quantum correlations in a QSS 
state. 

CQ: Classical information is shared among parties by 
distributing QSS states through (insecure) public chan- 
nels, which are open for eavesdropping. The quantum 
correlations in the QSS states can be used both to de- 
tect the disturbance of eavesdropping and to encode se- 
cret sharing. When comparing with the hybrid approach 
that unifies classical secret sharing and quantum key dis- 
tribution (QKD), the CQ scheme can reduce the cost of 
communication [3]. 

QQ: Also known as quantum state sharing, a secret 
quantum state is shared among parties by distributing 
QSS states through public channels. The QQ scheme can 
be implemented by either encoding the quantum secret 
into a QSS state, or using a QSS state to distribute en- 
tanglement between the dealer and the access structure 
for teleporting the secret state. We consider the later 
approach in the current paper. 

The three tasks form a hierarchy of the required re- 
sources, i.e., a QQ quantum state can perform all the 
three tasks, and a CQ state can be used for CC, while 
the reverse is not always true. In principle, construct- 
ing a QQ state is versatile, but the amount of resources 
and the required infrastructure can be optimised accord- 
ing to the properties of the shared information and the 
channels. 

For CC and CQ, we consider the cluster states are mea- 
sured by the dealer and the access structure. Because of 
the entanglement, random but strongly correlated mea- 
surement outcomes will be obtained, from which the 
dealer and the access structure can distill secure keys. 
Therefore the secret sharing rate, i.e., the amount of clas- 
sical information securely shared in each round of QSS, 
is determined by the net amount of secure key distilled 
from each cluster state. 

For QQ, we consider the dealer and the access struc- 
ture extract entanglement from the cluster states. Af- 
ter accumulating enough extracted states, entanglement 
distillation can be conducted to distill a more entangled 
state, through which the secret state can be teleported 
from the dealer to the access structure with higher fi- 
delity. 

We note that in all the QSS tasks, the objective of 
the dealer is to securely transmit the secret to the access 



structure, although the identities of the access structure 
are not revealed until all QSS states have been received. 
Because, in a secure protocol, the mutual information 
between the dealer and the access structure is larger than 
the information obtained by the adversary structure, the 
access structure's identities can be authenticated using 
parts of the shared information. The dealer should then 
trust the access structure and co-operate in subsequent 
post-processing of the shared QSS states. 

We also note that in the limit of infinite squeezing, our 
cluster state scheme is not as general as the QQ scheme 
proposed in Ref. [6|. However our scheme is interesting 
because all three kinds of QSS are considered in a unified 
approach, and the resource state is a cluster state that 
can be efficiently constructed and can be easily analysed. 



B. Continuous- variable cluster states 

As an analog to the discrete- variable cluster state, 
which is formed by preparing all qudits in an eigenstate 
of the generalised Pauli X operator and then applying 
controlled phase (CPHASE) gate, a CV cluster state is 
formed by first preparing all quantum modes as squeezed 
vacuum states and applying CV CPHASE gates, given by 
C = cxp{iAijqiqj}. An n-mode CV cluster state can be 
characterised by an n- vertices graph, where the quantum 
modes act as the vertices V = {f;}, and a CPHASE op- 
eration is a ppl ied across edges E = {e.y = {vi,Vj}} with 



weight Ai 



\. The CV cluster state W) is defined as 



|*) := H exp{t^^}|^)®" 



where in the infinitely squeezing case 

|V'o)mfinitc = |0) p , where p|0) p = , 
and in the finitely squeezing case 
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where \q) q is the eigenstate of q with eigenvalue q; a is a 
parameter characterising the degree of squeezing. 



1. Nullifier representation 

Apart from the ket vector representation, an infinitely 
squeezed cluster state can be characterised by its sta- 
bilisers [18|, (22|. A stabiliser S of a state \ip) is defined 
as the operator of which \tp) is an eigenstate with +1 
eigenvalue, i.e., S\ip) = \ip). Analogous to the discrete- 
variable cluster state, an n-mode infinitely squeezed CV 
cluster state has at least n independent stabilisers. Al- 
though any sum and product of the stabilisers is a new 
stabiliser, the whole set of stabilisers uniquely specifies 
the cluster state [23. 



In a CV system, considering the milliners of a cluster 
state is sometimes more convenient than the stabilisers. 
A milliner N is defined as an operator of which \ip) is 
an eigenstate with eigenvalue 0, i.e., N\tj}) — 0. There 
can be infinitely many choice of milliners as any sum and 
product of milliners is another nullifier. For an infinitely 
squeezed CV cluster state, we choose a set of milliners, 
which we call the standard set, i.e., [23| 



N; 



Pi 






Qj 



(4) 



where the position operators are summed over indices 
of the neighbours of the vertex i in the graph, i.e., 
j\(i,j) € £■ The standard milliners can be constructed 
by considering that before the CPHASE operations, the 
squeezed vacuum modes are nullified by Pi's. The 
CPHASE operation between the mode i and j transforms 
the nullifiers as pt — > e lAzj ' li ' ij p l e~ lA ^' 1 ^ = pi — AijQj. 
From the construction procedure, it can be easily shown 
that all standard nullifiers commute and are linearly in- 
dependent. 



2. Wigner function representation 

As an extension to the nullifier representation, the 
Wigner function is a good description of the quantum 
correlation of finitely squeezed CV cluster states. The 
Wigner function of a single mode CV state p is defined 

as 23] 



1 f°° 
W(q,p) := — / exp(tpx) 



q -2 



q+l) q dx 



(5) 

where the definition can be trivially generalised to the 
multi-mode state. The Wigner function of n finitely 
squeezed vacuum states is given by 

Wb(q,p) = — nexp(-^)exp f-^J , (6) 

and that of a finitely squeezed CV cluster state is 

1 n / N 2 
W c (q,p) = W (q,N) = —l[cxp(-<j 2 q 2 )exp 1- 



(7) 
where q = (qi,-..q n ) T , P = (pi, ■ ■ -Pn) T , and N = 
(A r i,...A r „) T ; N t is the standard nullifier in Eq. (JU) 
with the operators replaced by the respective scalar vari- 
ables; the initial degree of squeezing of each mode i is 
ctj. In the infinitely squeezing limit, i.e., <r, — > Vi, the 
exp(— afqf) would converge to a constant function while 
the exp(— iVj/of ) term becomes a delta function, i.e., 



W / infinito(q, P) OC Y[ S(Ni) 



3. Correlations of measurement 

Consider an infinitely squeezed CV cluster state is lo- 
cally measured by the operators {Mi}, where Mi is a 
linear combination of qi and pi, i.e., homodyne detection 
in a rotated basis. If the measurements are compatible 
to a nullifier, there exists a linear combination of Mj's 
that equals to a linear combination of standard nullifiers, 
i- e -; J2i=i. n k i M * = Yli=i,n,hNi for some real fci's and 
real l^s, then the measurement outcomes would be cor- 
related due to the entanglement as J2i=i n kiM. b — 0. 

Similar quantum correlations of measurements prevail 
in finitely squeezed CV cluster states, but the accuracy 
depends on the degree of squeezing. Consider a finitely 
squeezed CV cluster state is measured by the same set 
of measurement operators {Mi}, the expectation value of 
the measurement outcomes are statistically correlated as 
in the infinitely squeezed case, i.e., 



J2 hMi) = ( J2 liNi) = 



(9) 



However, the variance is finite, i.e., 

2 



i= l,7i i=l,n 

/( E ^)V(q,p)d n qd" P = E %M*°) 



but scales as a 2 that is small. The correlation comes from 
the exp(— Nf/af) terms in Eq. (|7|), which are narrow 
width Gaussian functions. 

In subsequent discussions, we regard a quantum cor- 
relation is "strong" if the collective variance of the lo- 
cal measurement outcomes is small, and so the modes 
are strongly correlated if their local operators produce 
strong correlations. Our QSS scheme is secure if the ac- 
cess structure is stronger correlated to the secret than 
the unauthorised parties. According to Eq. (|10[) . the lo- 
cal measurement operators are strongly correlated if they 
linearly combine as a nullifier and oVs are small, so we 
usually encode the secret in nullifiers. 



^. Cluster-class state 

A class of states that shares similar properties as the 
CV cluster state can be constructed by applying local 
Gaussian operators onto |^). The operations linearly 
transform the quadrature operators in nullifiers, as well 
as the quadrature parameters in the Wigner function, as 



q — > a q q + b q p + c q and p —> a p q + b p p + c p for some 
real constants a,b,c that obey the uncertainty principle. 
General linear transformations can be implemented by 
only three kinds of basic operators 24]: displacement, 
squeezing, and Fourier operator. 
(8) A displacement operator D(a) shifts a nullifier by a 

constant factor, i.e., the components in nullifiers are 



transformed as q — >• q + \/2Re(a) and p-)p+ \/2Im(a). 
All the displacements do not affect the measurement ba- 
sis nor the variance of the quantum correlations, but only 
the expectation values of the measurement results are 
changed. A squeezing operator 5(7) = exp(— ir(qp + 
pq)/2) scales the quadrature operators as S^qS — > ^q 
and S^pS — > p/j, where 7 = e r . Linear coefficients 
of Xi and f>i in the nullifiers will be altered but the 
measurement basis remains the same. A Fourier oper- 
ator F(9) = exp(—i9(q 2 + p 2 )/2) transforms the quadra- 
ture operators as F^qF — cos9q + sin 9p and F'pF = 
— sin 8q + cos Op. The Fourier operator changes the local 
measurement bases for the quantum correlation. 



III. CC QUANTUM SECRET SHARING 

In the CC setting of QSS, the dealer is connected to the 
n parties through secure quantum channels. A classical 
secret value s is encoded by displacing certain modes i of 
the cluster state by some function fi(s), where fi(s), the 
strength of the CPHASE Aij , and the neighbours of the 
cluster J\f are designed for specific access and adversary 
structure. For a well constructed CV cluster state for 
CC QSS, each collaboration of access structure should 
be able to construct a nullifier containing s by linearly 
combining their local quadrature operators. On the other 
hand, every adversary structure cannot construct a nul- 
lifier containing s by their local operators. 

As the channels are assumed to be ideal, the parties 
should obtain the same state as what was prepared by 
the dealer. We assume the access structure measure their 
modes using homodyne detection, and the measurement 
outcome is shared through secure classical channels. On 
the other hand, the adversary structure can unite their 
modes through ideal quantum channels, and can conduct 
any operation allowed by physics. 

In the case of infinitely squeezing, the security of the 
scheme can be verified if the reduced Wigner function of 
the adversary structure is independent of s. However, 
such criterion is not applicable in the finitely squeezing 
case because the reduced Wigner function would weakly 
depend on s even though the infinitely squeezed coun- 
terpart is secure. The security of the QSS scheme can 
be analysed by comparing the amount of information ob- 
tained by the access structure and the adversary struc- 
ture. In following discussion, we denote the quantities 
of the access structure by the subscript A, that of the 
adversary structure by E, and that of the dealer by D. 

The information obtained by the access structure is 
quantified by the mutual information, I(D : A), be- 
tween the dealer and the access structure [251 ] . Suppose 
the dealer chooses a secret value s following a proba- 
bility Vd(s), and encodes s in the cluster state. The 
access structure does not measure the same value due 
to the finite squeezing. The probability of obtaining a 
measurement result s' follows a probability distribution 
Va\d( s : s '), while the total probability, V A (s'), of the ac- 



cess structure's measurement is given by 

V A (s') = J V D {s)V A \ D {s,s')ds . (11) 

The mutual information I(D : A) is defined as [25| 

I(D : A) = H(A) - H(A\D) , (12) 

where H(A) is the entropy of the access structure's mea- 
surement, which is defined as 



H(A) = - f V A (s')logV A (s')ds' 



(13) 



and H(A\D) is the entropy of access structure condi- 
tioned on knowing s, which is defined as [251 ] 

H(A\D) = - J Vd(s)Pa\d(s, s') logT AlD (s, s')dsd s ' . 

The amount of information leaked to the adversary 
structure, I(D : E), is capped by the Holevo bound \ 

Earn, i.e., 



I(D : E) < X = S(pe) - J V D (s)S(p ElD ( S ))ds , (15) 

where S(p) is the von Neumann entropy; Pe\d{s) is the 
state obtained by the adversary structure if s is prepared 
by the dealer; pe is the average state obtained by the 
adversary structure, viz. 



Pe = V D {s)pE\D{s)ds 



(16) 



As CV cluster states are Gaussian, the reduced state 
of the adversary structure is also Gaussian. The von 
Neumann entropy of Gaussian states can be calculated 
by using their covariance matrix V, which is defined as 
Vij := ({Axi,A Xj })/2 HI]. If the Wigner function of 
an r-mode Gaussian state is known, V can be obtained 
through the relation [18| 

w( X) = eM~mx-*rv_H*-*)) (17) 

(2 7 r) r % /dctV 

where x = (qi,pi, ■ ■ ■ , q r ,p r ) T - Covariance matrices 
can be characterised by their symplectic spectrum {vk\, 
which is equal to the eigenspectrum of the matrix |iJlV| 
[la] , where 

1 if i = 2k- 1, j = 2k , 
Qij ■ = [ -1 if i = 2k, j = 2k-l, (18) 

else, 

for k = 1, . . . , r. The von Neumann entropy is calculated 
using 



S{p) =X^K) » 



(19) 



where 



u + V\ Xog L + l - 



Mi ( l 

v log V 

2 5 l 2 



In the case that the covariance matrices of pe and 
Pe\d are independent of s, their respective von Neumann 
entropies are also so. Then the Holevo bound can be 
simplified as, 



I(D : E) < S( PE ) - S(p E \ D ) 



(21) 



The minimum secret sharing rate in each round of the 
protocol is thus 



K cc = I(D : A) - I(D : E) 



(22) 



As examples, K cc for the (2,3)- and the (3,5)-protocol 
are calculated as follows. 




o.s 



o,s 



FIG. 1: Schematic representation of the cluster states for the 
(2,3)-protocol (left), and the (3,5)-protocol (right). Each oval 
represents a squeezed mode, which will be distributed to the 
party, denoted by the label inside the ovals. The subscript of 
each mode denotes the squeezing parameter and the displace- 
ment before the CPHASE operation. The edges joining 
modes represent CPHASE operations with the strength 
denoted by the edges' label. 



A. Example 1 of CC Quantum secret sharing: 
(2,3)-protocol 

In a (2,3)-CC protocol, the access structure is any two 
of the three parties collaborating, while the adversary 
structure is any collaboration with only one party. The 
(2,3)-CC protocol can be implemented by a linear three- 
mode cluster, as shown in Fig. Q] We assume the dealer 
picks the secret classical value s following a Gaussian 
probability distribution with a width E, i.e., 



V D {3) = 



1 



\AF£ 



D - s 2 /s 2 



(23) 



The state is encoded by displacing mode 2 by is/%/2 and 
mode 3 by —is/\/2. In the infinitely squeezing case, the 
milliners of the CV cluster state are 

Ni = p\ - q 2 - <?3 ; ^2 = Pi - q\ + s ; N 3 = p 3 - q x - s . 

(24) 



1. Parties {1, 2} collaborating 

Consider parties 1 and 2 are the access structure. If 
the cluster state is infinitely squeezed, the shared secret is 
the difference between p measurement outcome of party 1 
and q measurement outcome of party 2, i.e., s = q\ — p2 
according to N%. Deriving from Eq. ((HJ, the reduced 
Wigner function of party 3 is a constant function inde- 
pendent of s, thus the protocol is secure. In the finitely 
squeezing case, the Wigner function is given by Eq. J7]) 
with the nullifiers in Eq. (1241) . For simplicity, we assume 
the modes are equally squeezed, i.e., <Xj = a for all i, but 
our analysis is applicable for inhomogeneous Oi. 

The measurement basis of the parties is the same as 
the infinitely squeezing case. The classical probability of 
the measurement results p2 and q\ is 



V 



W 

A\D;{1,2} 



(Ql,P2) 



1 



e -(pz-gi-«) /a e 



2 2 

-a g t 



(25) 



which is obtained by tracing out q\, P2, and the contri- 
butions of party 3 in the Wigner function. The proba- 
bility distribution of the difference of the measurements, 
s' = q\~P2-, can be obtained by tracing out an orthogonal 
quantity, e.g. (pi + q-i)j1, then we get 



'PA\D;{1,2}(S,S') 

and thus 

^;{l,2}(s') = 



1 



■ exp 



( S - S ') 2 



n^a 2 + S 2 



(-^) 



- s ' 2 /(<^ 2 +s 2 ) 



(26) 



(27) 



The mutual information between the dealer and the ac- 
cess structure can then be calculated using Eq. (TI"2"1) . 

We now consider the adversary structure. The reduced 
Wigner function of pe and Pe\d{s) are 



We\D;{3} 
W E ;{3} 



2 ((P3-°) 2 +<?g(l + <r 4 )) 



ttVI + (J 4 
W E \ D -{ 3 }ds 



'I?, - 



ttVI + o- 4 + o- 2 S 2 

The covariance matrices of these states are 

l 

2ct- 





_ / 2^ 





1 + <T 4 



'E;{3} 



(28) 



29) 



l+o- 4 +g^ 



Ve\D;{3} — 

V " 2cr 2 / \ " 2a 

(30) 
where the symplectic eigenvalues are ve\d\z) — 
Vl + cr 4 /2cr 2 and v E . {S} = %/l + cr 4 + a 2 S 2 /2cr 2 , respec- 
tively The Holevo bound can then be calculated using 
Eq. (|T9]) and (|2"Tj) , and hence the secret sharing rate can 
be obtained from Eq. (|22p. 

Because both party 2 and 3 hold the end mode of the 
cluster state, the structure of their local states is the 
same, i.e., all Wigner functions will be the same as above 



except replacing the subscript 2 by 3 and s by —s. The 
security for party {1,3} collaboration can be analysed 
by similar procedure as the {1,2} collaboration, and the 
secret sharing in both collaborations will be the same. 



2. Parties {2,3} collaborating 

Consider parties 2 and 3 are now the access structure. 
In the infinitely squeezed case, because the operator N 2 — 
N3 — t>2 ~ Vz + 2s is also a nullifier, the secret s can be 
obtained if both parties conduct p measurement, i.e., s = 
{—P2 +Pd,)/2. The protocol is secure because the reduced 
Wigner function of party 1 is a constant independent of 
s. 

In the finitely squeezed case, the measurement results 
of p\ and P2 follow a probability distribution 



,W 



K\D;{2,3}(P^P^ 



1 



7T V^ 



: exp 



(P2 -P3 + 2rf 

cr 2 (2 + cr 4 ) 



- CT 2 ((p 2 + S ) 2 + ( P 3-s) 2 )/(2+<x 4 ) 



(31) 



The first exponent accounts for the strong correlations 
while the last exponent is higher order weak correlations. 
The quantity s' — (— p 2 + p^,)/2 follows the probability 



'Pa\D;{2,3}{s,s / ) 
and thus 



1 



27TCT 



exp i 



'Pa-{2,3}(s') = 



n{a 2 + 2S 2 



■ exp 



2{s-s , f 



2s' 



2£ 2 



(32) 



(33) 



For the adversary structure party 1, the reduced 
Wigner function of Pe\d-,{i} is 



W, 



E\D;{1} 



irV2- 



(34) 



Because Eq. (|34|) is independent of s, the Wigner func- 
tion of Pe-.{i} an d Pe\d-{i} would be the same, i.e., 
We\d-,{i} — W E ;{\}- Therefore the Holevo bound van- 
ishes and party 1 cannot get any information, and hence 
the secret sharing rate is simply I(D : A). 

The secret sharing rate for different collaborations is 
plotted against a in Fig [5] Surprisingly, although both 
party {1,2} collaboration and {2,3} collaboration can 
obtain s in infinitely squeezing case, the secret sharing 
rate of collaborations is different in the finitely squeez- 
ing case. On the theory side, the unequal secret sharing 
rate is related to the graph structure of the cluster state. 
On the practical side, the dealer has to consider the dis- 
advantage of certain collaborations when applying CC 
QSS. 

On the contrary to common beliefs that a CV state 
with cr = l cannot transmit secure information, we note 
that the CC secret sharing rate is non-zero in some sce- 
narios even when a > 1. The result is not surprising 




FIG. 2: Secret sharing rate of CC QSS protocols using CV 
cluster states with different squeezing parameters a. The vari- 
ance of the classical secret probability is chosen as E = 1. Left 
panel: (2,3) protocol for {2,3} collaboration (solid line) and 
{1,3} collaboration (dashed line). Left panel: (3,5) protocol 
for {1,2,3} collaboration (solid line) and {1,3,4} collaboration 
(dashed line). 



in cluster state QSS, because implementing a CPHASE 
requires the initial modes to be squeezed. In fact, a two- 
mode cluster state can be easily showed to be local uni- 
tarily equivalent to a finitely-squeezed EPR state unless 

a — > oo. 



B. Example 2 of CC Quantum secret sharing: 
(3,5)-protocol 

In a (3,5)-CC protocol, the access structure is any 
three of the five parties collaborating, while the adver- 
sary structure is any collaboration with less than three 
parties. The (3,5)-CC protocol can be implemented by 
a star-shaped five mode cluster, as shown in Fig. [TJ All 
five modes of the cluster state are displaced by —is/V2, 
where the classical secret s is assumed to be chosen ac- 
cording to the probability distribution given in Eq. (|23p . 
In the infinitely squeezing case, the nullifiers of the CV 
cluster state are given by 



Nt 



Pi ~ Qi+l - Qi-l 



(35) 



where i + 1 = 1 when i — 5; i — 1 = 5 when i = 1. 

Ten different combinations of access structure can be 
formed in this protocol, but they can be categorised into 
two classes of collaborations, which are three neighbour- 
ing parties, and two neighbours with one disjoint party. 
Without loss of generality, we consider parties {1,2,3} as 
an example of three neighbours collaboration, and parties 
{1,3,4} for two neighbours collaboration. The security 
proof and secret sharing rate of these two cases can be 
adapted to other collaborations after indices changing. 



1. Parties {1,2,3} collaborating 



2. Parties {1,3,4} collaborating 



Consider parties 1, 2, and 3 are the access structure. In 
the infinitely squeezing case, the secret s can be obtained 
if both parties 1 and 3 measure q and party 2 measures 
p, i.e., s = —qi +P2~q3 according to iV 2 in Eq. (|35|). The 
reduced Wigner function of parties {4, 5} collaboration 
is a constant function after tracing out the contributions 
of the access structure in Eq. ©. 

In the finitely squeezing case, the probability mea- 
surement by parties {1,2,3} is determined by the re- 
duced Wigner function W A \D;{i,2,3}(qi,Pi,q2,P2,q3,P3) 
after tracing out the contributions of parties 4 and 5. As 
the measurement bases are fe, Pi, and 53, the measure- 
ment probability is obtained by tracing out the depen- 
dence of pi, 52 , and p% from the reduced Wigner func- 
tion. The probability distribution of the received secret, 
s' = P2 — qi — 53, can be obtained by first substituting 
the set of variables (51,^2,53) by another linearly inde- 
pendent set of variables (51, s', 53), and then tracing out 
51 and 93. The Jacobian matrix of this variable trans- 
formation is 1, so the form of probability distribution 
remains the same [271 ] . 

The tracing processes described above involves differ- 
ent physical meanings, but the end result is that all con- 
tributions except s' are traced out. So the probability 
distribution of s' can be obtained in only two steps: first 
substituting p 2 = s' + 51+53 in the total Wigner func- 
tion, and then tracing out all variables except s'. In this 
case, we get 

1 / (s-s') 2 \ 

?A|fl ;{ l,2,3}(s»S ) = ^rZ eX P ( ~ ,2 ) > ( 36 ) 



\FkO 



and thus 



V A ;{1,2,3}( S ') = 7E / T 2 +S 2 C 



11 n 2 , vi2\ 
-s /{a +2^ ) 



(37) 



For the adversary structure parties 4 and 5, the re- 
duced Wigner function of We\d-{4,5} and We- {4,5} can 
be obtained by tracing out the contribution of parties 
1,2,3. The covariance matrices of these states are 



/ 2a 1 
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E\D;{4,5} 
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2a 1 
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2a 1 
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+^J 
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E;{4,5} 
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2a- 



cr 2 +S 2 
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2a' 2 
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2a 1 





+ 



2 
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2a- 





cr 2 + S 



,(38) 



(39) 



/ 



where the symplectic spectrum are ve\dA4,o\ 
{VTTc^/2<t 2 , VI + a i /2a 2 } and 
{VTTc^/2<t 2 , Vl + CT 4 + 2 t T 2 £ 2 Ar 2 }- 



u E-{4,5} 

The 



Neumann entropy can then be calculated using Eq. (1191) , 
and the secret sharing rate is calculated from Eq. 



Consider now that parties 1, 3, and 4 are the access 
structure. In the infinitely squeezing case, the secret s 
can be obtained when party 1 measures p, party 3 and 
4 measures p' — (p — q)/y/2. Because Ni — N3 — N4 is 
a nullificr, their measurement results are correlated as 
—p\ + V%P3 + \/2p4 = s. The reduced Wigner function 
of parties {2,5} collaboration is a constant function, so 
the secret sharing is secure. 

In the finitely squeezing case, the probability distri- 
bution of the quantity s' = —p\ + p^ — 53 + p^ — 54 
can be obtained by first substituting the set of vari- 
ables (51, pi, 53, P3, 54,^4) with the new set of variables 
(51, s', 53, P3, 54, P4). The determinant of the Jacobian 
matrix of this transformation is 1. All variables except 
s' are traced out from the reduced Wigner function, then 
we get 



PA|D;{1,3,4}(S|»') 



37TCT 



exp 



(s-s') 



(-^). <«> 



and thus 



^A;{l,3,4}( s ') 



-s' 2 /(3<t 2 + S 2 ) 



vW3ct 2 + S 2 



(41) 



For the adversary structure parties 2 and 5, the covari- 
ance matrices of the states Pe\d-{2,5} and Pe-,{2,5} are 



/ 



V 



V 



E-{2,5} 



-E|-D;{2,5} 
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2a 2 
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2<T 2 





V 
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2ct 2 
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2a 1 
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2fT 2 





\ 



+4/ 



si 
2 



V 



1 

2a 2 



The symplectic spectrum 
{VTTc^/2a 2 , V3Tc^/2<j 2 } 




1 

2cr 2 


are 
and 



si 
2 



(42) 



(43) 



2 ~ 1 ' 



u E\D;{2,o} 
V E;{2,5} 

{VI + cr 4 /2cr 2 , V3 + cr 4 + 2cr 2 £ 2 /2cr 2 }, respectively. 

The von Neumann entropy can then be calculated by 
Eq. P^)l . and hence the secret sharing rate by Eq. (|2"2"|) . 
Just as in the case of (2,3)-CC protocol, the secret 
sharing rate of (3,5)-protocol for {1,2,3} collaboration 
and {1,3,4} collaboration are different because of the 
difference of entanglement structure. The secret sharing 
rate for different collaborations is plotted against a in 
FigH 



IV. CQ QUANTUM SECRET SHARING 

In the CQ setting of QSS, the dealer is connected to the 
parties through insecure quantum channels, so the unau- 
thorised parities can manipulate all the modes sent from 
the dealer. The CC protocol mentioned in Sec. Mil is 
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insecure in this setting, because the adversary structure 
can capture and measure the modes to obtain s. This 
eavesdropping can be intractable if the adversary struc- 
ture resends to the access structure an infinitely squeezed 
state with the same s encoded, so the access structure 
with have the same measurement result as the adversary 
structure. 

Here we modify the CC protocol for the CQ setting. 
We first present an entanglement-based protocol, and dis- 
cuss how it can be reduced to a mixed-state protocol that 
reduces the resource requirement. Instead of construct- 
ing an n-mode cluster state and encoding a classical se- 
cret s into the state, the dealer prepares an (n + l)-mode 
standard cluster state, where n of the modes are deliv- 
ered to the parties while the dealer keeps the remaining 
one, denoted as mode D. A good CQ protocol should 
produce quantum correlation between the dealer and the 
access structure much stronger than that between the 
dealer and the unauthorised parties. 

Here we make two assumptions to simplify the demon- 
stration of the security, but the assumptions will be re- 
laxed at the end of this section without compromising the 
secret sharing rate. We assume the access structure par- 
ties are connected by secure and ideal quantum channels, 
so the modes can be sent to one party, say party h, with 
perfect fidelity. We also assume both the dealer and the 
access structure have quantum memories, so the cluster 
states in each round of CQ are stored with perfect fidelity 
for subsequent quantum operation and measurement. 

The procedure of CQ QSS is outlined as follows. In 
each round of CQ QSS, an entangled state is shared be- 
tween the dealer and the access structure. Consider that 
the strong correlation is represented by the two milliners, 
Pd — Qa and qp — Pa , which are linear combinations of 
the standard milliners. Qa and Pa are linear combina- 
tions of only the access structure parties' local q and p 
operators. By applying a global operation, Ua, on all the 
modes at party h, Qa and Pa are transformed to qh and 
■ph- As a result, the strong correlations with mode D are 
transferred to mode h. 

After all the rounds of cluster state distribution, the 
stage of parameter-estimation ensues. The dealer or 
party h randomly selects half of the shared modes for 
measurement, and the selection is announced. Both the 
dealer and party h measures the selected modes in ei- 
ther the x and p basis. The measurement outcomes are 
announced for characterising the unmeasured states. 

In the infinitely squeezing case, the estimated parame- 
ters should indicate that the state between mode D and 
mode h is maximally entangled. [42[ The dealer and 
party h measure each residual modes randomly in ei- 
ther the q or p basis, the basis is then announced. Each 
measurement outcome is a random number on the real 
axis, and the outcomes are the same if the measurement 
bases are matching, i.e., one party measures in q while 
the other measures in p. The common random numbers 
can be used as secure keys to encode the secrets. Be- 
cause the state was maximally entangled, no information 



is leaked to unauthorised parties. 

In the finitely squeezing case, although mode D and 
mode h are strongly correlated, the state of adversary 
structure is still weakly correlated with mode D. As 
to be discussed, local quantum operation is applied on 
each residual mode to rectify the covariance of the state 
according to the estimated parameters. The dealer and 
party h then measure each mode in cither the x or p basis, 
and announce the basis. Unlike the infinitely squeezed 
case, post-processing is required to distill secure keys 
from the correlated measurement outcomes due to two 
reasons. First, even if the measurement basis is match- 
ing, the measurement outcomes of the dealer and the 
access structure are merely strongly correlated but not 
exactly equal. Besides, partial information about the 
outcomes is leaked to unauthorised parties due to the 
non-uniform distribution of the measurement outcomes 
and the weak entanglement between the unauthorised 
parties' and the dealer's modes. 

In the following, we employ the security analysis tech- 
niques from CV-QKD 28] to estimate the minimal rate 
of secure key distilled from each cluster state, and hence 
the secret sharing rate in each round of CQ QSS. 



A. Equivalence of CQ Quantum secret sharing and 

QKD 

We now show why CQ QSS and CV-QKD can be anal- 
ysed using the same techniques. Consider before the 
CPHASE operation, mode D is squeezed with ao while 
all other modes are squeezed with a. Assume the mode 
D is connected to N neighbours after the cluster state 
formation, the reduced Wigner function of mode D is 



W D (q D ,p D ) = 



aar>e 



tt^JN + a 2 a 



cxp 



Ph 



'D 



N/a< 



(44) 

Wd is the same as the reduced Wigner function of a two- 
mode cluster state |Cjv), where mode D is connected to a 
mode u that is squeezed with a/y/N. Because both the 
CQ cluster state and |Cjy) are pure, the amount of en- 
tanglement between the mode D and the delivered modes 
is the same as the entanglement between the modes in 

|Cjv>- 

As in the common security analysis of QKD, we grant 
the unauthorised parties the full power to manipulate the 
modes sent from the dealer. Then there will be no dif- 
ference for the dealer to prepare the CQ cluster state or 
\Cn), because the unauthorised party can transform the 
delivered cluster state modes to mode u or vice versa. 
Then our CQ state delivery is equivalent to the follow- 
ing scenario: The dealer first prepares \Cn) and deliv- 
ers mode u through an insecure quantum channel. The 
unauthorised parties capture mode u, entangle it with 
ancillae, and forward some modes to the access struc- 
ture. 



QKD 



QSS 




Deliver strong 
correlation to mode h 



I I Dealer 
| Unauthorized parties 



delivered to the authorised party through an imperfect 
channel [I3 [29| ■ Both parties measure some of the deliv- 
ered states to estimate the covariance matrix, V, of the 
unmeasured states. Using the fact that Gaussian states 
minimise the distilled secure key rate for every state shar- 
ing the same V |29|, [3(| , assuming the unmeasured states 
being Gaussian upper-bounds the information leakage to 
unauthorised parties. Because a Gaussian state is com- 
pletely characterised by its covariance matrix, the secure 
key rate can be deduced from only V. For realistic chan- 
nels that are usually symmetrical for quadratures x and 
p, V can be expressed in a standardised form as 



VI cZ 

cZ VI 



(45) 



_| Authorized parties OE5 "Ql^ 1 



where I and Z are the 2x2 identity and Pauli Z matrices 
respectively; V is the variance of the undelivered mode 
of the dealer; V' is the variance of the mode received 
by the authorised party; c is the correlation between the 
two modes. V can be characterised by only V and two 
channel parameters, the transmittance, r, and the noise, 
X, which are defined by the relations 



FIG. 3: Strategy for computing the secret sharing rate using 
CV-QKD techniques. Strongly (weakly) correlated modes are 
linked by solid (dotted) lines. The procedure of CQ QSS 
is shown on the right while that of QKD is shown on the 
left. The key idea is that both QKD and QSS have the same 
initial (pure entangled state with parts delivered) and final 
resources (strongly correlated state between the dealer and 
the authorised parties.) 



The access structure's modes are then gathered at 
party h. After the operation Ua, modes other than mode 
h are still weakly correlated with mode D. For simplicity, 
these weak correlations are neglected in our analysis, i.e., 
all modes except h are traced out. This action only re- 
duces the quantum correlations between the dealer and 
the access structure, thus the security is not unphysi- 
cally improved. Now the CQ protocol is effectively re- 
duced to a CV-QKD protocol: The dealer first prepares 
a two-mode Gaussian state, \Cn), and delivers one mode. 
The access structure finally gets a mode h that remains 
strongly correlated with mode D, but the quantum cor- 
relation is reduced due to the entanglement with the en- 
vironment controlled by the unauthorised parties. The 
degradation of quantum correlations in the encoding and 
decoding processes in CQ QSS can be analogous to the 
loss and noise when transmitting an EPR state through 
an imperfect channel in QKD. The whole idea is sum- 
marised schematically in Fig. [3] 



B. Secret sharing rate 

In the unified picture of CV-QKD, a finitely squeezed 
two-mode squeezed state is prepared by the dealer and 



t(V 2 



1 



); V'=T(V+X) 



(46) 



To estimate the minimal secret sharing rate of the CQ 
QSS, in the parameter-estimation stage the dealer and 
the access structure construct the covariance matrix by 
measuring some of their modes. A quantum operation is 
then applied on the unmeasured modes to transform their 
covariance matrix to the standard form, from where the 
analogous r and \ can be extracted according to Eq. (|45|) . 
In the following parts of this section, we demonstrate the 
procedure of getting the standardised covariance matrix 
for different collaborations in the (2,3)- and (3,5)-CQ pro- 
tocols. 

We assume our protocol is direct reconciliation, i.e., 
the measurement result of the dealer is the secret value 
that has to be estimated by the access structure, but the 
secret sharing rate of a reverse reconciliation protocol 
can be easily calculated by similar procedure. The secret 
sharing rate, Kcq, is given by [28| 



K CQ = I(D : A) - I{D : E) , 



(47) 



where I(D : A) is the mutual information between the 
dealer and access structure; the information obtained 
by unauthorised parties is given by I{D : E), which is 
capped by the Holevo bound. 

The mutual information I(D : A) can be calculated 
by comparing the variance of mode h with and without 
knowing the measurement results of mode D. In terms 
of the analogous channel parameters, the mutual infor- 
mation is given by [28| 



I(D : A) 



b< 



v 



x 



1 

4V 



(48) 
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In direct reconciliation protocols, the Holevo bound of 
the unauthorised parities' information is defined as 



I(D : E) = S{E) - S{E\D) , 



(49) 



where S(E) is the von Neumann entropy of unauthorised 
parties' state, S(E\D) is the conditional von Neumann 
entropy if the measurement result of the dealer is known. 
As the unauthorised parties can control the environment 
that purifies the whole system, the entropy of the unau- 
thorised parties is the same as that of the system DA, 
i.e., S(E) = S(DA). The entropy can be calculated us- 
ing Eq. HHJ} as S(DA) = g(v+) + g{yJ) [lj|, where the 
symplectic spectrum of V, {^+, v~}, is given by 



v± 



= l(V(V + V'f - 4c 2 ±(V -V')) 



(50) 



Similarly, because the state of system AE is pure after 
system D is measured, the conditional entropy S(E\D) 
is the same as S(A\D). The covariance matrix of system 
A after the measurement of the dealer is given by [3l|, (32[ 



Va\d = 



V 



2 /V 
V 



(51) 



where the symplectic eigenvalue is 



'' = dV'[V'-y\ =rMV + x)(y + x) ■ (52) 



Hence we get S(E\D) = g(v c ). 



C. Example 1 of CQ Quantum secret sharing: 
(2,3)-protocol 

In a (2,3)-CQ protocol, any two of the three parties 
can form a strong correlation with the dealer, while any 
one party is only weakly correlated with the dealer. The 
protocol can be implemented by a diamond-shaped CV 
cluster state with A^3 = A 13 = A 12 = 1 and Ad 2 = — lj 
as shown in Fig. |4j We note that the diamond-shaped 
CV cluster state is also a form of error correction of a 
CV cluster state [l£|. In the infinitely squeezing case, 
the nullifiers are 

N D = p D + q 2 - 43 ; Ni=pi-q 2 - q 3 

N 2 = f>2 + qD - 4i I N 3 = p 3 - q D - q\ . (53) 

The finitely squeezed state is described by Eq. (J7J with 
the above nullifiers. 

The access structure can be composed by parties {1,2}, 
{1, 3}, and {2, 3}. The entanglement structure possessed 
by collaborations {1,2} and {1,3} are equivalent, be- 
cause the nullifiers of {1,2} will be the same as that of 
{1, 3} if the dealer applies a 7r-phase operation, F(n), to 
his mode. On the other hand, the collaboration {2,3} 
possesses a different entanglement structure. 





FIG. 4: Schematic representation of the cluster state for the 
(2,3) CQ protocol (left), and the (3,5) CQ protocol (right). 
All of the modes are not displaced before the CPHASE op- 
eration. The strength of unlabelled edges is A = 1 . 



1. Parties {1,2} collaboration 

If parties {1,2} are the access structure, the strong 
correlations are specified by the nullifiers 

N D - Ni = Pd - Vi + 2g 2 and N 2 — qD - <7i + P 2 .(54) 

A global operation is applied on the access structure's 
mode to transfer the strong correlation to mode 2, i.e., 
mode 2 is treated as mode h. The transformation can be 
implemented by various sequence of operations, but the 
final measurement results and the covariance matrix are 
not affected. One possible choice is the {1,2} Decoding 
Sequence: (i) apply exp(— iqifa)', (ii) then exp(ipip 2 ); 
(iii) finally F 2 (n). 

After tracing out the modes other than mode D and 
mode 2, the covariance matrix of the resultant state pda 
is given by 



V 



DA;{1,2} 



( 
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2^; 
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2a'j- 
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J 



The covariance matrix will be revealed in the parameter- 
estimation stage when half of the states are measured. 
As ~Vda-,{i,Z} is n °t hi trie standard form, i.e., Eq. (|4"5j) . 
rectifying quantum operations are applied onto the resid- 
ual states. First of all, the variance of 4d and po are 
balanced by squeezing mode D with the squeezing pa- 
rameter 



0\D 

a 



lD = \l—\/2 + a^a 2 D 



(56) 



Next, mode 2 is squeezed to balance the coherent terms, 
i.e., (A(7£>Ap 2 ) and (AppA^)- The squeezing parameter 
is given by 



72 



2a D 



a^/2 + a 2 a 2 D 



(57) 
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In practice, both jn and 72 can be obtained from the re- 
sults in parameter-estimation stage, i.e., without know- 
ing the squeezing parameter of the initial cluster state. 
This squeezing stage will transform the state pda as 

PDA -> PDA = S D {lD)S 2 (l2)pDASi("l2)S D (-iD) , (58) 



where the covariance matrix becomes 

I ^(2,3) 



c 



V, 



DA;{1,2} 



\ 





^(2,3) 
C 
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V 




c 




v 



(59) 



for V(2,3) = y2 + cr 2 a D /2ao-D ; c = I/v^ctctd; the vari- 



ance of mode 2 is 



V 

1 



aa D 



V^ 



^•2^-2 



Kf = 



(2 + a 4 )y2~ 



'D 



4(7 C"£) 



(60) 

We note that jd and V(2,3) are the same for any col- 
laboration in the (2,3)-protocol, because mode D is kept 
with the dealer that is not affected by operations on de- 
livered modes. The disparity between V' and VI implies 
imbalanced noise for the quadratures q 2 and f>2- As the 
aim of this paper is to demonstrate the possibility of per- 
forming CQ QSS using CV cluster states, we balance 
the variances of fo and f>2 by a 'state-averaging' process, 
which would nonetheless sacrifice some quantum corre- 
lations. Consider the dealer randomly divides the un- 
measured states into two sets, and the choice of division 
is announced. In one set, the dealer applies a Fourier 
operator, Fd{— 7r/2), on each mode that transforms the 
quadrature operators as qn — > Pd and pu — > — qjj. In 
the other set, party 2 applies Fd{— tt/2) on each mode 
that causes the transformation q 2 — > f>2 and p 2 —> —<h- 
After that, the choice of division is discarded. The state 
will be transformed as 



Pda ~~* Pda 



F D (-7r/2)p? DA F D (-ir/2) 



+ -F 2 (-n/2)p' DA F^-n/2) . (61) 



The covariance matrix of p D a ^ s given by 





f 


/ (2,3) C 


V" - 




F (2)3 ) -c 
c V A . {1 . 2} 




\ 


-c V A:{h2} 



, (62) 



where Va;{i.2} — (Vq + V')/2 with the definition in 
Eq. (|60l) . Finally, the modes are measured by the dealer 
and party 2 in either the q or p basis. The variances of 
the measurement results will be given by Eq. (1521 . 

We note that p" DA is not a Gaussian state because the 
stage-averaging process in Eq. (I5T1) is not a Gaussian op- 
eration. To calculate the secret sharing rate using the 
techniques in Sec. IIVB1 we assume the measurement re- 
sults originates from a Gaussian state pa where its covari- 
ance matrix is V. According to Ref.s [23, |3(|, Gaussian 
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FIG. 5: Secret sharing rate of CQ QSS protocols using CV 
cluster states with different squeezing parameters a. The 
squeezing parameter of dealer's mode is set as <t_d = er. Left 
panel: (2,3) protocol for {2,3} collaboration (solid line) and 
{1,3} collaboration (dashed line). Right panel: (3,5) protocol 
for {1,2,3} collaboration (solid line) and {1,3,4} collaboration 
(dashed line). 



states minimise the secure key rate for all states with the 
same covariance matrix. Therefore our action maximises 
the power of the unauthorised parties and lower-bounds 
the secret sharing rate. 

By comparing Eq. (l62t with Eq. (|45|) . the variance of 



the dealer's mode is V = V( 2 3)j and the analogous chan- 

•1/4) = 



(2,3) , 

nel parameters can be deduced as r — c 2 /(V, 



(2,3) 

The minimal secret sharing 
The 



1 and x = Va-,{i,2} ~ V(2,3)- 



rate can then be calculated by Eqs. (|47H50|) and (|52 
result is plotted in Fig. [5] for different a. 



2. Parties {2,3} collaboration 

If parties {2, 3} are the access structure, the strong 
correlations are specified by the nullificrs 



Nd = Pd + <72 - <?3 and 



N 2 -N 3 



qD- 



V2 



El 

2 



(63) 



The quantum correlation can be transferred to mode 2 
by the {2,3} Decoding Sequence, which is simply a 50:50 
beam splitter that transforms 0,2 — > —(62 + 0,3) /\/2 and 
S3 — > {a.2 — 0,3) /y2. The resultant covariance matrix 
between mode D and mode 2 becomes 
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The secure sharing rate can be deduced by similar pro- 
cess as in the {1,2} collaboration: squeezing and trans- 
forming local modes to construct a state with standard- 
ised covariance matrix, and then measuring the states 
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to obtain the analogous channel parameters for comput- 
ing the information of different parties. However, the 
{2, 3} collaboration is special as the dealer and party 2 
are actually holding a pure state, i.e., the beam splitter 
has removed all entanglement from the unauthorised par- 
ties. This can be seen from the symplectic spectrum of 
Eq. (|M|l . ^{2,3} = {1/2, 1/2}, so the entropy of the system 
DA vanishes, i.e., S(DA) = 0. Therefore the unautho- 
rised parties cannot obtain any information about the 
secret by entangling their modes to the dealer's mode. 
The secret sharing rate is hence the same as the mutual 
information between the dealer and the access structure, 
which is given by 



I(D:A)=\og(2V {2 , 3) ) 



(65) 



The secret sharing rate is plotted in Fig. [5] for different 
ex. We note that the secret sharing rate is non-zero even 
when a > 1. As we have discussed in the CC case, a two- 
mode cluster state is still entangled even if the initial 
state is not squeezed. The entanglement between the 
dealer and party h imposes strong quantum correlations 
that can distill secure keys. 



D. Example 2 of CQ Quantum secret sharing: 
(3,5)-protocol 



In a (3,5)-CQ protocol, any three of the five parties can 
form a strong correlation with the dealer, while any col- 
laboration with less than two parties is only weakly corre- 
lated with the dealer. The protocol can be implemented 
by a pentagonal CV cluster state, as shown in Fig. 21 
where each connected vertex is entangled by a CPHASE 
operation with Aij = 1. In the infinitely squeezing case, 
the milliners arc 
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q.i+i - &-i - qD , (66) 



1. Parties {1,2,3} collaboration 

If parties {1,2,3} are the access structure, the strong 
correlations are specified by the nullifiers 

Nd - Ni + 2N 2 -N 3 = pd- (Pi + 3<7i) + (2p 2 + «a) 

-(p 3 +3q 3 ) 
and — N 2 = qd - h + <7i + q 3 ■ (67) 

The quantum correlations can be transferred to party 
2 by the {1,2,3} Decoding Sequence: (i) applying 
cxp(-iqiq 2 ) and exp(-iq 2 q 3 ); (ii) then exp(ipip 2 ) 
and exp(ip 2 p 3 ); (iii) finally exp(ip 2 (2pi + qi)) and 
exp(ip 2 (2p 3 + q 3 )). 

The covariance matrix of the state pda between mode 
D and mode 2 is given by 



DA;{1,2,3} 



/ 



1 




1 

2aJ, 











5 + cr-CTj, 

2a 2 

5 


5 
5+6<t 4 


2a 2 


2a 2 



1 

2^5 

^ o 



o 



2a 2 



\ 



I 



(68) 



All terms in V da,{i,2, 3 } can be revealed by x and p mea- 
surements in the parameter-estimation stage except for 
the local coherent terms ((Aq 2 Ap 2 + Ap 2 Aq 2 )/2). How- 
ever these terms do not affect the parameters in the 
squeezing stage, and will be eventually cancelled during 
state-averaging. 

The unmeasured states are squeezed locally to balance 
the variance of qo and po, as well as the coherent terms. 
The state is transformed as in Eq. ([58| . where the pa- 
rameters for the {1,2,3} collaborations are 
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The covariance matrix of the transformed state is given 
by 
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(70) 



where % + 1 = 1 when i — 5; i — 1 = 5 when i = 1. 
The finitely squeezed state is described by the Wigner 
function in Eq. (JTJ) with the above nullifiers. 

The access structure can be composed by two cate- 
gories of collaboration: three neighbouring parties, e.g. 
parties {1,2,3}, and two neighbours with one disjoint 
party, e.g. {1,3,4}. The collaborations in each category 
hold nullifiers with the same form, so the decoding se- 
quence will be the same. If the squeezing parameter is 
identical for all five modes, the secret sharing rate of the 
collaborations in each category will also be the same. 



where V( 35 ) = y/b + <j 2 <7 d /2<j<7d ', c = \fhj2o-or), and 
the variance of mode 2 is given by 
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(71) 
The value of jd and Vfa 5) are the same for any collabo- 
ration in the (3,5)-protocol. 

State-averaging ensues to balance the correlations of 
Pd — <?2 and qo — P2- Half of the unmeasured states 
are transformed by Fd(— tt/2), while the other half are 
transformed by F 2 (—tt/2). After discarding the choice 
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of division, the state transforms as Eq. (|6Tj) . where the 
covariance matrix becomes 



V 



(72) 

for V A . {h2 ,3} = (Vg+V£)/2 with the definition in Eq. ([TTj). 
We note that the local coherent terms vanish after state- 
averaging because their sign in Fjj(— ir/2)p' DA F D (— 7r/2) 
and F 2 (— ir/2)p' DA Fl(— it/ 2) are opposite. 

We again assume the measurement results come from 
a Gaussian state with the same covariance matrix 
V'^.rj 2 3 i . The variance of the dealer's mode is recog- 
nised as V = V(3£), and the analogous channel param- 
eters can be deduced as r = c 2 /(V, 2 5) — 1/4) = 1 and 

X = Va ; {i,2,3} — ^(3,5)' The minimal secret sharing rate 
can then be calculated by Eqs. (|47H50p and ([52"]l. The 
result is plotted in Fig. [5j 



2. Parties {1,3,4} collaboration 

If parties {1,3,4} are the access structure, the strong 
correlations are specified by the nullificrs 



N D - 2Nx 
and iVi 



N* 



N* 



N± = p D - (2p! + q x ) + (p 3 - 2q 3 ) 
+(P4 - 2q 4 ) 

A^4 = qD+Pl- (P3~Q3) 

-(P4-&) • (73) 

The quantum correlations can be transferred to mode 1 
by the {1,3,4} Decoding Sequence: (i) apply exp(— i(q\ + 
§3 - 93)) and exp(-i(qi + p 4 - q 4 )); (ii) followed by 
exp(ipip3) and exp(ipij) 4 ); (hi) then exp(i2p 2 ); (iv) fi- 
nally F(ir). 

The covariance matrix of the state pda between mode 
D and mode 1 is given by 



/ 



V 



DA;{1,3,4} 



1a% 






V 2^ 





5+<t 2 o-j 

2<T 2 

5 
So 3 ' 






5 

5+6cr 4 

-2a 2 



1 



-2a 2 

2ai, 



\ 



J 



After the parameter-estimation stage, local-squeezing 
is applied as in Eq. (1551) except mode 1 is now mode h. 
The squeezing parameter in the current collaboration is 
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The covariance matrix of the unmeasured states then be- 
comes 

/ %5) c \ 
v / _ V(3,5) c 

V DA;{1,3,4} " C y g ' 

\ c v;j 



(76) 



where c = \fhj2auD-, and the variance of mode 1 is given 
by 



, = (5 + 6^)^5 + o 2 a l D . , = 5(1 + 3a 2 ^) 
9 10(7<t d ' p 2aa D ^5 + o- 2 (T i D ' 

(77) 
State-averaging ensues to balance the correlations of 
Pd — qi and qn — p\ . The covariance matrix becomes 
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(78) 

where Va ; {i,3,4} = (V^ + V^)/2 with the definition in 
Eq. (|77|) . Similar to the {1,2,3} collaboration, the lo- 
cal coherent terms are eliminated by state-averaging. 

After local q and p measurements, we again assume 
the results come from a Gaussian state. The variance of 
the dealer's mode is recognized as V — V( 3i5 ), and the 
analogous channel parameters can be deduced as r = 
c 2 /(V ( l 5) - 1/4) = 1 and X = V A , {1 , 3A} - V (3 , 5) . The 
secret sharing rate is plotted in Fig. [5J 



E. Simplification 

In the above analysis of CQ protocols, we assume an 
(n + l)-mode cluster state has to be created and quan- 
tum memory is available to store the delivered modes 
until all of the states are received as well as an ideal quan- 
tum channel being available between the access structure 
parties. Here we show that these requirements can be re- 
laxed without compromising the security. 



1. Mixed state approach 

Because the distributed modes are unaffected by any 
local operation of the dealer, the state obtained by 
the parties is the same regardless of whether mode D 
has been measured. Therefore, instead of preparing an 
(n + l)-mode cluster state |\I/) and measuring mode D 
afterwards, the dealer can simulate the consequence of 
the measurement by distributing an n-mode state that 
is the same as the measured | \i?) . Consider if the dealer 
intends to measure in the q basis, then the dealer can 
instead prepare the pure state ((s|q£>)|^), where \s) qD is 
a qo eigenstate with the eigenvalue s. Similarly in the p 
measurement rounds, the dealer can prepare ({s\ VD )\^), 
where \s) PD is the po eigenstate with the eigenvalue s. 
Other parties cannot distinguish the mixed state from 
|<i?) if s is picked according to the probability distribu- 
tions of dealer's measurement results on |$). The prob- 
ability distributions are imposed by the Wigner function 
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in Eq. fl44J| as 



F„„(*> J W D (s,p D )d PD = ^e-o s2 ; (79) 



^Pn( s ) = / W D (q Dl s)dq D 
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In the simulated q measurement rounds, the infinitely 
squeezed ((s| qi3 )| , I') is characterised by the milliners 
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(81) 



where i = l,...,n; AiD = if the mode i is not a 
neighbour of mode I?. The nullihers Nf is the same as 
Ni except the operator qjj is replaced by the simulated 
measurement outcome s. In the finitely squeezed case, 
the state can be characterised by the Wigner function 
W qn (qi,Pi, ■ . . , q n ,Pn), which is obtained by tracing out 
po and replacing all qo by s in the Wigner function of 
| '&) . Because W qn is the same as W c in Eq. ([7]) with the 
milliners Nf, (( s \qr>)\^) i s a cluster-class state that can 
be formed by displacing a finitely squeezed cluster state. 
In the simulated p measurement rounds, the infinitely 
squeezed ((s\p D )\^) is characterised by the milliners 
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(82) 



where j — 2, . . . , n. In the finitely squeezed case, 
the state can be characterised by the Wigner function 
W PD (qi,pi, . . . ,q n ,p n ), which is obtained by tracing out 
qo and replacing all po by s in the Wigner function of 
| "<&) . However unlike W qo , W PD is not necessarily repre- 
sentable by the form of W c with the nullifiers N±, there- 
fore ((slpo)] 1 ^) is generally not a cluster-class state. Nev- 
ertheless, ((s| P£ ,)| v I') is a Gaussian state that can be ef- 
ficiently prepared by offline squeezed states and linear 
optical elements [19j . 



2. Classical memory 

When estimating the secret sharing rate, we need the 
delivered modes to be rectified so the covariance matrix is 
in the standard form. The modes are stored in quantum 
memories until the covariance matrix is constructed from 
parameter-estimation. Here we show that the measure- 
ment probability distribution of the transformed state p" 
can be obtained by: first measuring the original state p, 
and then subjecting the measurement results to classi- 
cal manipulations. Therefore the delivered modes can be 
measured before the parameter-estimation stage, quan- 
tum memory is thus not necessary. 

The rectifying process involves two stages: local- 
squeezing and state-averaging. After state-averaging, 
p" becomes a mixture of i*b(— n/2)p'Fj :i (— n/2) and 



F h {-%/2)p'Pl{-%/2). By definition, the Wigner func- 
tion of p" , W", can be written as the sum of the Wigner 
function of p' , W , as 

W"(q D ,PD,qh,Ph) = ^W(p D ,-qD,qh,Ph) 

+^W'(q D ,pD,Ph,-qh) -(83) 

Consider the dealer measures p" in qjj and party h 
measures in qt, the probability of obtaining measurement 
outcomes yi and y 2 , P'q D , qh (yi,y2), is given by 



Pqn l9h (3/1,3/2) = / W"(yi,p D ,y<2,Ph)dpDdph 

= 2 / w '(PD,-yiiy2,Ph)dp D dp h 
+ 2 / w '(yi,PD,Ph,-y2)dp D dp h 

= 2 P p D ,9h(-yi' 2/2) + 2 V 'iD,p h (y^ -2/2) , 

(84) 

where the last equality involves renaming of variables; 
V XD x is the joint {xn,Xh} measurement probability of 
p' . Similarly, the probability of another strongly corre- 
lated measurement, {pD,Ph}, can be expressed as 

^,^(3/1,2/2) = ^'P'q D , Ph (yi,y2) + 2^p D> ? h (3/i>3/2) ■ 

(85) 

These two relations indicate that the measurement 
probability distributions after state-averaging are not 
different from mixing some measurement probability dis- 
tributions before state-averaging. Consider the dealer 
and party h randomly measure p' in x and p basis. Half 
of the {qD,Ph} outcomes and half of the {pD,qh} out- 
comes are picked to mimic the {qD,(jh} measurement of 
p" . For the {qD,Ph} half, all the ph outcomes are mul- 
tiplied by —1 and then regarded as qu outcomes; for the 
{pD,qh} half, all the pr> outcomes are multiplied by — 1 
and then regarded as qr> outcomes. After mixing the two 
sets of data, the probability V m of getting 7/1, y 2 is given 
by 



V m (y^y 2 ) 
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2 PD,qn 
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-2/2) , 

(86) 

which is the same as Eq. (|84|) . The {pD,Ph\ measurement 
probability of p" can be mimicked by similar procedures. 
In local-squeezing stage, the dealer and party h ap- 
ply local squeezing operations, Sd(jd) and Sh{^h) , to 
balance the variance of mode D and the coherent terms. 
The Wigner function of the state p transforms as 

W(q D ,p D ,q h ,p h ) -> W'{q D ,p D ,q hl p h ) 

= w(^, lDPD ,^, lhPh ) (87) 
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Consider p' is measured in qo and ph basis, the prob- 
ability of obtaining the outcomes j/i , 2/2 is given by 
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where V is the probability distribution when measuring 
p. Similarly, the probability distribution of pu and qh 
measurement transforms as 
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(89) 



Measurement results of {qD,Qh} and {p~D,Ph} are sifted 
as they are merely weakly correlated. 

In fact, physically squeezing the state is not necessary 
because the transformations in Eqs. (|88|) and ([89)) can be 
conducted by classically scaling the measurement results. 
Consider every qi measurement results are scaled by I/7,:, 
and every pi measurement results are scaled by 7.;. The 
old probability, V, of a q measurement result lying in the 
range [y, y + dy] , is equal to the new probability, V s , of a 
scaled result in the range of [72/, 72/ + r ydy]. Thus we have 
the relation V(y)dy — V'( r yy) r ydy for q measurement, and 
similarly V(y)dy = V'{y / 'l)dy / '7 for p measurement. By 
eliminating common factors and redefining variables, we 
get 
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The above resultant probability distributions are the 
same as Eq. (|8"5|) and 



through secure classical channels to decide the measure- 
ment basis to be Qa or Pa, the dealer and authorised 
parties homodyne detect their modes according to the ba- 
sis M 9 or M ? . The measurement results are then shared 
among access structure through secure classical channels. 
Without loss of generality, we consider that the access 
structure has chosen to measure Qa- The measurement 
result Qa is a linear combination of local measurement 
results M 9 , i.e., Qa — J^MM?. The strong correla- 
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tion is observed from the joint probability distribution 
of po and Qa, which we will show is the same as the 
joint probability distribution of po and qh- Consider the 
Wigner function of the state of the dealer and the ac- 
cess structure, Wda{<1d,Pd,*Ia,Y>a) where q^ and p^ 
are the quadrature variables of the access structure, is 
obtained by tracing out the unauthorised parties' contri- 
butions in W c in Eq. IJ7]). When rewritten in terms of 
the new variables M« = {Mj} and *M 9 = {*Mj}, the 
Wigner function becomes 

W DA (q D ,PD,C l A,PA) = W DA (q D ,p D ,M q ,*M q ) , (92) 

where *Af 9 is the complementary variable of M?, i.e., 

The 
choice of {*M?} is not unique, but we can pick the set 

that Pa is a linear combination of. 

We construct another set of variables Q = 
{QA,Q2,---,Q m } and P = {P A ,P 2 ,...,P m }, where Q 
(P) involves linear combinations of {M 1 -} ({*M?}) only; 
and the corresponding operators obey the commutation 
relations: [Qj,Pi] = iSji, [Qj,Qi] = 0, and [Pj,Pi] = 0. 
Such a construction of variables is possible as there exists 
unitary operators that transform M 9 to Q and *M to P 
while preserving the commutation relations. In terms of 
Q and P, the Wigner function can be further rewritten 
as 

^DA(to,^,M 9 ,*M 9 ) = iy^( to , P D,Q,P) . (93) 



the corresponding operators satisfy [M ? *M, 



3. Local measurement 

We have assumed the access structure parties have for- 
warded their modes to a single party for global opera- 
tions. Here we show that the measurement results of the 
dealer and access structure remains strongly correlated 
even if the access structure conducts local measurements 
only. 

Recall the strong correlation is represented by the mil- 
liners pd — Qa and qo — Pa- Because they are linear 
combinations of standard nullifiers, both the operators 
Qa and Pa are sums of local operators, i.e., 



Qa = J2 k ]MJ i p A 



l^h$M>, (91) 



The local measurement results follow a classical proba- 
bility distribution V DA , which is obtained by tracing out 
the complementary components, i.e., 

V da (pd,M«) = Jw DA dq D d m (*Ml) 

= I W^ A dq D d m P , (94) 

where the last equality is imposed because P is a linear 
combination of *M 9 only. The probability distribution 
of Qa is obtained by tracing out the other independent 
i.e., 



variables in V D 4 , 



Vda{pd,Qj 



V' DA dQ 2 dQ 



3 • • 



(95) 



where fc 9 and k p - are real coefficients; M 9 and M v - are ro- 
tated quadrature operators of mode j . After discussing 



On the other hand, consider the access structure par- 
ties' modes are transferred to party h. The strong 
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quantum correlation is transferred to mode h by ap- 
plying a global operation, Ua, which transforms Qa — > 
UaQaU a = Qh and Pa -* UaPaU a = Ph- Other oper- 
ators are transformed as Qj —} ijj and Pj — > Zj. Using 
the definition in Eqs. (J92J and (|93|) . the Wigner function 
becomes 

W DA (qD,PD, <l,p) -> Wn A (q D ,p D ,q h ,p h ,y,z) , (96) 

where y = (j/ 2 , • • ■ , 2/m) T and z = (z 2 , . . . , z m ) T . Because 
Qj and Pj commute with both Qa and Pa, the trans- 
formed operators ijj and £j do not contain any attributes 
of mode h. The joint probability distribution of po and 
qh is obtained from the Wigner function after tracing 
out the modes other than mode D and h, as well as the 
complementary variables qu and ph, i.e., 



VDA(j>D,qh 



W^ A dq D dp h d m ' l yd m - l z . (97) 



The probability distribution in Eqs. (|95p and (|9"7)l are 
deduced by different procedures. The former one is de- 
duced by first obtaining the classical probability distri- 
bution of all local measurements, and then extracting 
the probability distribution of the classical variable Qa] 
the later one is deduced by first achieving the Wigner 
function of the transformed quantum state, and then ob- 
taining the measurement probability of the operator qh- 
However, Eqs. (|9"5)l and (|9"7)I are mathematically equiva- 
lent because their overall derivations are the same: trac- 
ing out all quadrature variables in the Wigner function 
except those specifying the strong correlation. Similar 
analysis can be applied to the correlation between qo 
and Pa- As a result, the access structure can obtain the 
same covariance matrix as we have discussed previously. 
Hence the secret sharing rate remains unchanged even if 
the access structure's modes are measured locally. 



4- Simplified CQ protocol 

Incorporating the above ideas, the CQ protocol can 
be simplified as follow: an (n + 1) cluster state or an n 
mode mixed state is prepared by the dealer and delivered. 
Parties in the access structure have agreed on the mea- 
surement basis in each round, local measurements are 
conducted on each received modes. The classical mea- 
surement results are shared among the access structure 
through secure classical channels. Both the dealer and 
the access structure announce half of the results to esti- 
mate the covariance matrix; while the other half is scaled 
and mixed so the covariance matrix is in the standard 
form. The variance and the analogous channel parame- 
ters are then recognised for calculating the secret sharing 
rate. Finally a secure key is distilled from the strongly 
correlated measurement results, the key is then used for 
sharing classical secrets. 

We end this section with two comments. First, al- 
though the quantum channels for delivering cluster states 



are assumed to be ideal, we believe a modified ver- 
sion of our protocol would allow CQ QSS with realis- 
tic (lossy and noisy) channels. The covariance matrix of 
the delivered modes can still be obtained by parameter- 
estimation, and subsequent classical manipulations can 
always turn the measurement results to obey the stan- 
dard covariance matrix. 

Second, in all the examples we have investigated, the 
entanglement with the unauthorised parties' modes only 
add noise to the access structure parties' modes, but the 
analogous transmittance are retained as 1. This result 
is surprising in the scenario of CV-QKD, because im- 
perfection is always simulated by adding noise into a 
beam splitter which reduces transmittance. We believe 
this phenomenon originates from the distinctive entangle- 
ment structure in the resource states between CQ QSS 
(a cluster state) and CV-QKD (an EPR state). 



V. QQ QUANTUM SECRET SHARING 

In the QQ setting of QSS, the dealer shares a secret 
quantum state among parties by delivering a multipar- 
tite entangled state. The channels connecting the dealer 
and the parties can be insecure, so the unauthorised par- 
ties can manipulate all the delivered states. In an ideal 
QQ protocol, the access structure can recover the secret 
state with perfect fidelity, while the unauthorised parties 
cannot get any information about the state due to the 
quantum no-cloning theorem [33|. 

Our QQ QSS scheme is a generalisation of the CQ pro- 
tocol. The dealer prepares an (n + 1) mode cluster state, 
of which n modes are distributed to the parties while one 
is kept by the dealer. After forming the collaborations, 
the access structure parties forward their modes to party 
h. We assume the parties are connected by secure quan- 
tum channels, so the access structure can combine their 
modes without being eavesdropped. A global operation 
is applied to extract a strongly entangled state between 
mode D and a single mode h. 

For an infinitely squeezed QQ cluster state, the strong 
correlation between the dealer and the access structure 
is represented by the nullifiers po — Qa and qr> — Pa- 
After all modes are gathered in party h, an operation Ua 
is applied to transfer the quantum correlation to mode 
h, i.e., Q A -► U a QaU a = Qh and P A -t U a PaU a = Ph- 
We note that both the nullifiers, Qa and Pa, and the 
operation Ua are the same as that in the corresponding 
CQ protocol in Sec. IIV1 

The transformed nullifiers, pr> — qh and qo — Ph, indi- 
cate that the dealer and party h are sharing an infinitely 
squeezed two-mode cluster state, which is a CV maxi- 
mally entangled state (for infinite energy). By jointly 
measuring the secret state and the two-mode cluster, the 
dealer can teleport the secret state to mode h. After ap- 
propriate error correction according to the dealer's mea- 
surement results, party h can revert the secret state with 
perfect fidelity. 
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In the finitely squeezing case, party h conducts the 
same Ua to transform the strong correlation to mode h. 
However, mode D and mode h are not maximally entan- 
gled, because their state is finitely squeezed and is weakly 
entangled to other modes. Conducting teleportation us- 
ing the non-maximal entanglement will reduce the fidelity 
of the teleported state. The inaccurately shared secret 
state may indicate a reduction of security of the QQ QSS, 
because some information about the secret state would 
be leaked through the measurement results announced by 
the dealer, and through the states held by the adversary 
structure that are weakly entangled with the teleported 
state. 

Instead of conducting teleportation after each round 
of QQ QSS, we consider the extracted state is stored in 
quantum memories. After rounds of the QQ protocol, a 
more entangled state can be distilled from the stored ex- 
tracted states through CV entanglement distillation J3J- 
|38[ . Although distilling a maximally entangled CV state 
is impossible due to the infinite required energy, the en- 
richment of entanglement can enhance the fidelity of the 
teleportation. 

The amount of entanglement of the distilled state is 
determined by that of each extracted state, as well as the 
number of extracted states accumulated in the quantum 
memory. We quantify the amount of entanglement by the 
logarithmic negativity E 39] , which is the upper bound of 
the distillable entanglement. The logarithmic negativity 
of a state p is defined as 



eos) = log ||p 



*Ta\ 



(98) 



where the superscript Ta denotes a partial transpose of 
the density matrix; 1 1 • 1 1 1 is the trace norm. If p is a 
two-mode Gaussian state with a covariance matrix V, 
the logarithmic negativity can be calculated as 



E(p) = Y,F(h) 



(99) 



where F(x) = - log(2x) if x < 1/2, and F(x) = if 
x > 1/2; ji/fc| is the symplectic spectrum of V, which is 
defined as WOf 
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(100) 



The covariance matrix V can be obtained by randomly 
measuring some of the stored states in either^ or p. 

Because logarithmic negativity is additive [39| , at least 
Eo/E extracted states with logarithmic negativity E is re- 
quired to distill a two-mode squeezed vacuum state with 
logarithmic negativity Eo. In this section, we demon- 
strate the procedure of extraction, and calculate the log- 
arithmic negativity of the extracted state in each round 
of the (2,3)- and the (3,5)-protocols. 

We note that logarithmic negativity is additive but 
not strongly superadditive [30( , so the amount of entan- 
glement may be overestimated if the access structure's 



modes in different rounds are entangled |4l|, i.e., when 
the unauthorised parties conduct coherent attacks on the 
delivered modes. In that case, the amount of entangle- 
ment should be characterised by other strongly super- 
additive entanglement measures, such as distillable en- 
tanglement and squashed entanglement [301 ] . However, 
logarithmic negativity is applicable in the current case 
because of our assumption of ideal quantum channels, so 
the access structure is expected to get the same states 
as prepared by the dealer. The adversary structure par- 
ties only get information about the shared secret through 
their modes obtained in each round, which is effectively 
a collective attack. 



Example 1 of QQ Quantum secret sharing: 
(2,3)-protocol 



In the (2,3) QQ protocol, any two out of the three 
participating parties can recover the shared secret state 
with high fidelity, while any one party achieves much 
less information about the secret. This protocol can be 
implemented by the same diamond-shaped CV cluster 
state as that for the (2,3)-CQ protocol in Sec. IIVCI In 
the infinitely squeezing case, the nullifiers are given by 
Eq. (|53|). and these nullifiers with Eq. <[7|) characterise 
the finitely squeezed cluster state. 

Three different collaborations can be formed: parties 1 
and 2, parties 1 and 3, and parties 2 and 3. The entangle- 
ment structure of the state of {1, 2} collaboration is the 
same as that of {1,3} collaboration, as their states are 
equivalent up to a local unitary. As a result, the entan- 
glement extracted between the dealer and parties {1,2} 
is the same as that between the dealer and parties {1,3}. 

For the {1,2} collaboration, the quantum correlation 
can be transferred to mode 2 by the {1,2} Decoding Se- 
quence in Sec lIVCTI In the infinitely squeezing case, the 
nullifiers in Eq. (jM)l . which specifies the strong correla- 
tion, is transformed to po — qi and qd —f>2- An infinitely 
squeezed two-mode cluster is hence extracted for telepor- 
tation. In the finitely squeezing case, the {1,2} Decoding 
Sequence also transfers the strong correlation to party 
2. The covariance matrix of the extracted state between 
mode D and mode 2 is given by ~Vda-,{i,2} hi Eq. (|55|) . 

For the {2, 3} collaboration, the quantum correlation, 
which is specified by the nullifiers in Eq. (RkJ)) , can be 
transferred to party 2 by applying a 50:50 beam split- 
ter between mode 2 and mode 3. An infinitely squeezed 
two-mode cluster state between mode D and mode 2 is 
extracted in the infinitely squeezing case. While in the 
finitely squeezing case, a strongly entangled state is ex- 
tracted with the covariance matrix V£>^.{2,3} in Eq. (|55|) . 
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B. Example 2 of QQ Quantum secret sharing: 
(3,5)-protocol 

In the (3,5)-QQ protocol, any three out of the five par- 
ticipating parties can recover the shared secret state with 
high fidelity, while fewer than three parties achieve much 
less information about the secret. This protocol can be 
implemented by the same pentagonal CV cluster state 
as used for the (3,5)-CQ protocol in Section IIVDI In 
the infinitely squeezing case, the nullifiers is given by 
Eq. (|66|) . and these nullifiers with Eq. ([7]) characterise 
the finitely squeezed cluster state. Two categories of col- 
laborations can be formed: three neighbouring parties, 
and two neighbours with one disjoint party. Within each 
category, the procedure of decoding and the final entan- 
glement extracted are the same for each collaboration. 

Take the parties {1,2,3} as an example of the three 
neighbouring parties collaboration. The quantum corre- 
lation can be transferred to party 2 by the {1,2,3} De- 
coding Sequence in Sec lIVDTI In the infinitely squeezing 
case, the nullifiers in Eq. (joT)) that specify the strong cor- 
relation are transformed to pr> — qi and qo—P2- This indi- 
cates an infinitely squeezed two-mode cluster is extracted 
in mode D and mode 2. While in the finitely squeezing 
case, the sequence of operations extracts a strongly en- 
tangled state with the covariance matrix V da-,{i i 3} m 
Eq. dMl). 

On the other hand, parties {1,3,4} is an example of 
the two neighbours with one disjoint party collaboration. 
The quantum correlations can be transferred to party 1 
by the {1,3,4} Decoding Sequence in Sec IIV D"2l In the 
infinitely squeezing case, an infinitely squeezed two-mode 
cluster is extracted in mode D and mode 1, because the 
nullifiers in Eq. (1731 that specify the strong correlation 
is transformed to po — q\ and qo — Pi- While in the 
finitely squeezing case, a strongly entangled state is ex- 
tracted, and its covariance matrix is given by Vda-,{i,3,4} 
in Eq. (|?4"j) . 

The logarithmic negativity of the extracted state 
for different collaborations in the (2,3)- and the (3,5)- 
protocols is calculated using Eq. (l99t with the corre- 
sponding covariance matrices. The result is plotted in 
Fig. [S] against different squeezing parameters. 



VI. CONCLUSION 

In this work, we extended the unified cluster state 
quantum secret sharing framework proposed in [10 . [l6[ 
into the continuous-variable regime. We proposed that 
all three tasks of quantum secret sharing can be imple- 
mented by CV cluster states. Although a QQ protocol 
can be used to conduct CC and CQ, simplifications in 
the later two scenarios can reduce the requirement of 
resources. For a CC protocol involving n parties, only 
n-mode cluster states are needed, and the states can be 
measured once received. A CQ protocol requires either 
a mixture of two n-mode Gaussian states or an (n + 1)- 
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FIG. 6: Logarithmic negativity of the state extracted from 
a CV cluster state in QQ QSS. Left panel: (2,3)-protocol 
for {2,3} collaboration (solid line) and {1,3} collaboration 
(dashed line). Right panel: (3,5)-protocol for {1,2,3} collab- 
oration (solid line) and {1,3,4} collaboration (dashed line). 



mode cluster state. The states can be locally measured 
once it is received. A QQ protocol requires (n+ l)-mode 
cluster states. The states have to be transferred to one 
party and accumulated in quantum memories for entan- 
glement distillation. 

On the contrary to discrete- variable systems, where no 
known physical principle hinders the creation of a max- 
imally entangled state, the creation of a maximally en- 
tangled CV state requires infinite energy and is thus not 
practical. Finitely squeezed states are realistic substi- 
tutes for the maximally entangled resources, but the non- 
maximal entanglement would leak information about the 
shared secret to the unauthorised parties. We proposed 
computable measures to account for the security of each 
of the three tasks of quantum secret sharing. The secret 
sharing rate of a CC protocol is the difference between 
the mutual information between the dealer and the ac- 
cess structure, and the adversary structure's information 
that is capped by the Holevo bound. The secret sharing 
rate of a CQ protocol can be computed by the secure key 
rate of the analogous QKD protocol. The performance of 
a QQ protocol can be determined by the amount of ex- 
tracted entanglement between the dealer and the access 
structure. 

Although we have analysed only the (2,3)- and the 
(3,5)- protocols that are both threshold protocols [4J, 
our technique is applicable to non-threshold protocols be- 
cause the security analysis involves only the variance of 
measurement results of the dealer and the access struc- 
ture. Security of general continuous- variable CQ and QQ 
protocols can also be analysed using our techniques, i.e., 
transferring the strong correlation to mode h and then 
compute the covariance matrix between mode D and 
mode h, even if the resource state is not a continuous- 
variable cluster state. 

To the best of our knowledge, our work is the first 
one showing that quantum secret sharing is feasible with 
finitely squeezed CV resources. Since a finitely squeezed 



cluster state can be deterministically constructed using 
only offline squeezers and linear optics, which are practi- 
cally available resources in current technology, we believe 
CV quantum secret sharing can be implemented in the 
near future. An important remaining question is to de- 
termine if the performance of quantum secret sharing is 
seriously worsened under the presence of environmental 
and apparatus noise. As we borrow the security analysis 
techniques from QKD, which works well in noisy circum- 



stances, it is likely that realistic performance of quantum 
secret sharing can be analysed using the formalisms pre- 
sented in this work. 
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